Hardcoded Password Vulnerability in CENTUM by Yokogawa

CVE-2025-7741

What is CVE-2025-7741?

A hardcoded password vulnerability has been identified in Yokogawa's CENTUM systems, where a default password for the PROG user account allows potential unauthorized access under certain conditions. This vulnerability applies specifically when products are configured in CTM authentication mode and when an attacker can obtain the hardcoded password before exploiting the vulnerability. Furthermore, malicious users must have direct access to the Human Interface Screen (HIS) controls to leverage this vulnerability. While the default permissions restrict critical operations, changes to user permissions could escalate risks significantly.

References